bpf-progs

This repository is self contained now. It compiles cleanly on Ubuntu 18.04 for kernel versions 4.14, 4.15, 5.3 and 5.5+.

apt-get install clang llvm gcc make libelf-dev libpcap-dev

install linux-headers for kernel version.

This code is structured to make the data collection as much of a template as possible, so new programs can copy-modify and focus on the analysis at hand as much as possible.

netmon

netmon is similar to dropwatch, but examines the packet headers and summarizes drops by a number of options:

• source mac,
• destination mac,
• IPv4 source IP,
• IPv4 destination IP, and
• network namespaces.

Network namespace support is best effort in determining the association. It has been used to look at drops for containers.

show packet drops sorted by destination IP

sudo src/obj/netmon -s dip

show packet drops sorted by destination mac

sudo src/obj/netmon -s dmac

TO-DO:

• support for drops at XDP layer

pktlatency

pktlatency is used to examine the overhead of the host networking stack in pushing packets to userspace. At the moment it is focused on virtual machines using tap devices and vhost. The program requires a NIC with PTP support (e.g., mlx5). I am very much new to PTP, so there very well could be some bugs here.

It too was just renamed, from skblatency to pktlatency, in hopes of adding support for packets pushed to a VM using XDP redirect.

example

sudo src/obj/pktlatency

ovslatency

ovslatency measures the time to run ovs_vport_receive which is the primary workhorse for the OVS rx_handler, netdev_frame_hook.

execsnoop / opensnoop

execsnoop and opensnoop are ebpf versions of what I previously would do using kernel modules. bcc's python version inspired me to do the deep dive on bpf attached to kprobes and tracepoints to get the same intent with ebpf.

examples

sudo src/obj/execsnoop sudo src/obj/opensnoop

XDP L2 forwarding

xdp_l2fwd handles Layer 2 forwarding between an ingress device (e.g., host devices) and egress device (e.g., tap device for VMs). Userspace populates an FDB (hash map) with <vlan,dmac> pairs returning an index into a device map which contains the device to receive the packet. See scripts/l2fwd-demo.sh for an example.

This program is used for the netdev 0x14 tutorial, XDP and the cloud: Using XDP on hosts and VMs https://netdevconf.info/0x14/session.html?tutorial-XDP-and-the-cloud

Dummy XDP program

xdp_dummy is a dummy XDP program that just returns XDP_PASS.